Copies of Rank Math PRO, the paid version of the popular WordPress SEO plugin, were distributed with malware through the company’s website and update system between 20:02 UTC on October 15 and 07:12 UTC on October 16.
Rank Math disclosed the incident in a security notice published on October 16, warning users that affected plugin files could put their websites at risk.
Websites that installed and activated one of the compromised copies should be treated as infected, even if the plugin has since been updated. According to Rank Math, the malware can recreate a hidden backdoor whenever someone visits the affected website, potentially allowing attackers to maintain access to the server.
Rank Math has removed the malicious packages and released a clean version, 3.0.124. However, installing the updated version does not automatically remove other malicious files, unauthorized administrator accounts, or scheduled tasks that may have been added during the attack. Wordfence highlighted these risks in a separate advisory published on October 17, warning website owners that replacing the plugin alone is not enough to ensure a complete recovery.
The incident affects Rank Math SEO PRO, which customers download and update through rankmath.com. The free version of Rank Math SEO distributed through WordPress.org is not identified as affected in the company’s security notice. The free plugin has more than four million active installations, according to its WordPress.org listing.
The version number alone does not establish whether a plugin copy was compromised. Although Rank Math’s changelog dates version 3.0.123 to October 7, the security incident was limited to copies downloaded or delivered through updates during the specified October 15–16 window. Copies obtained before 20:02 UTC on October 15 fall outside the identified incident window.
Rank Math advises users who installed and activated the affected version during that period to treat their websites as compromised and follow the recommended recovery process. Users who downloaded and installed the plugin but never activated it should delete the plugin files, install the clean version from their Rank Math account, and run a security scan. Those who downloaded the affected package but never installed or activated it have no indication of compromise from this incident alone.
The malware’s full technical behavior has not been publicly detailed in the security notices from Rank Math or Wordfence. However, the recovery guidance identifies several types of changes that attackers may have made to affected websites. These include PHP backdoors hidden in plugin and theme directories, unauthorized administrator accounts, a fake WordPress core file, modified .htaccess rules that allow certain cache files to execute as PHP, scheduled tasks, and additional SSH keys.
Because the malicious code may be able to restore a backdoor after it has been removed, cleaning individual files without first stopping the mechanism responsible for recreating them may leave the website vulnerable. Website owners should also assume that passwords, database credentials, API keys, and other secrets accessible to the compromised site may have been exposed.
Wordfence assigned the incident the identifier CVE-2026-111862 and gave it a severity score of 9.8 out of 10. The researcher behind the incident is listed as unknown. Patchstack also classifies the issue as a backdoor, noting that a conventional mitigation rule is not possible because the attack involved the plugin vendor’s own systems and update distribution channel.
For affected websites, Rank Math recommends restoring a backup created before 20:02 UTC on October 15, where a clean backup is available. Website owners should then run a security scan, rotate all relevant credentials, and install version 3.0.124 directly from their Rank Math account. A backup should only be considered safe after appropriate checks, as the presence of previously compromised files or credentials can allow attackers to regain access.
Where a clean backup is unavailable, the manual recovery process must follow a specific order. The first step is to delete the entire rank-math-pro plugin directory using the hosting file manager or FTP. Simply deactivating the plugin is not sufficient. The next step is to inspect the WordPress database’s wp_options table and remove any entries with the option names _uf6qdn2hmm, t8krdk990phb, or _np5pvf754c. Website owners should also block outgoing connections to rank1cdn[.]com if their hosting provider or firewall supports it.
After these initial steps, administrators should inspect the website and server for additional signs of compromise. The recommended checks include examining PHP files in the wp-content/mu-plugins directory, other plugin folders, non-default theme directories, Rank Math’s includes directory, and the uploads directory. Suspicious code may include base64_decode functions combined with XOR loops, references to the key xmmqhn, proc_open calls, or PHP-FPM socket code.
Administrators should also check for wp-includes/class-wp-cache-util.php, which is not a standard WordPress core file, and investigate unfamiliar administrator accounts with usernames beginning wpsupport_ or email addresses ending in @wp-mail[.]net. Other checks include reviewing .htaccess rules that allow .cache files to run as PHP, examining suspicious cache files, looking for crontab entries tagged #ms6v46, reviewing WordPress scheduled events, inspecting SSH authorized_keys files, and checking other user crontabs and running processes.
The investigation should not stop at the WordPress installation itself. Website owners should check other locations on the server where the web server account has permission to write, since malicious files may exist outside the site’s main directory. Wordfence cautions that failing to find the listed indicators does not, by itself, prove that a website is clean.
All relevant credentials should be changed, regardless of whether the site was restored from a backup or cleaned manually. This includes WordPress administrator passwords, database credentials stored in wp-config.php, WordPress security keys and salts, payment gateway credentials, SMTP and other API keys, hosting control panel passwords, FTP, SFTP and SSH access, and secrets stored in environment variables. Administrators should also review and reset two-factor authentication where necessary.
Once the cleanup is complete, website owners should run a security scan and verify WordPress core files using wp core verify-checksums. They can also run wp plugin verify-checksums –all, although checksum data may not be available for premium plugins. The WordPress.org plugin-checksums service does not provide a checksum record for Rank Math PRO, according to a check reported by The Hacker News on October 19, although a record is available for the free version.
The clean version, 3.0.124, should be downloaded directly by logging in to rankmath.com. Rank Math has warned that some customers may need to reset their account passwords if they cannot log in. The company also advises users not to trust login or download links sent by email.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Rank Math, which is part of the Swedish hosting group group.one, has not publicly explained how the malicious files entered its download and update infrastructure. The company has also not disclosed how many customers received compromised packages, whether automatic updates delivered the affected files, or the cryptographic hashes that would allow users to compare clean and malicious copies. It has said that it is taking steps to reduce the risk of similar incidents in the future.
Domain registration records show that rank1cdn[.]com, which Rank Math recommends blocking, was registered at 19:31 UTC on October 14, approximately one day before the identified distribution window began. The available disclosures do not establish who registered the domain or who was responsible for the attack.
